Auction site eBay has launched a private messaging service in a bid to reduce the impact of "phishing" attacks. The service, called My Messages, is available in the US and a similar service will be provided for UK users early this year. It was launched last month in an email to US subscribers that competed for attention with fake eBay emails sent by fraudsters.

The move to private email is being considered by a number of organisations affected by "phishers" - fraudsters that fool customers into visiting bogus sites by sending them fake emails in a bid to harvest confidential password information.

My Messages is a read-only inbox for subscribers logged into the eBay site. Effectively, it means that any emails that subscribers receive in their own inboxes are fakes and should be ignored. eBay says it will be used to give new information on buying, selling and events on eBay. A spokesperson said subscribers can use the service secure in the knowledge that all messages come directly from eBay.

Such a service could also benefit online banks. Sandra Quinn, a spokeswoman for the Association for Payment Clearing Services, said "such systems are under consideration but we need to ensure a uniform way of doing this. You have to remember that many people have more than one bank and we would not want different systems to cause added complications for customers."

In fact, most online banks already have a simple private email system available to customers once they are logged on, but its effectiveness is limited due to the fact that many banks also send emails direct to customers' inboxes where necessary. HSBC, for example, has what it calls Secure E-messaging, which is mainly used for marketing and some product information, but the bank confirmed that bank staff sometimes communicate with customers by email - to confirm meeting times, for example.

While security experts agree that eBay's private email service should help to reduce the impact of phishing, many have concerns regarding its effectiveness.

Andrew Lockhart, director of product marketing at US security firm Postini, said: "If I were a hacker and wanted to exploit this, I would immediately send a phishing email purporting to be about eBay's new private email service and lure users into giving up their personal information that way."

Another concern is that if the move is followed by others, then the convenience of email will be reduced as subscribers will have to go to a series of bank and commerce sites to get their emails.

Others point out that phishing attacks are increasingly making use of Trojans - software that sits on your PC tracking your keystrokes and then sending the details to fraudsters. Such software could be used to gain access to your private inbox on eBay, for example. Others suggest that private services such as My Messages will themselves become targets.

Indeed, early signs suggest My Messages is open to spam attacks, and some subscribers are yet to be convinced it is the best approach. On one US forum, a subscriber said: "I've already received spam in my eBay message box. I bid on something and then the next day someone sent me a message saying he had similar items and would I like to bid on his auctions."

Another subscriber expressed concern about the idea spreading to other services: "This may be a way to provide secure communications from eBay, but if everyone you do business with on the internet goes this route, then you will have to go from site to site just getting your messages. How time-consuming and inconvenient this method will be instead of checking your one email inbox instead. Maybe they should just find a universal way to use secure communications and fix the email systems."

But despite possible weaknesses, RSA Security believes eBay is setting the agenda. "eBay's move to provide increased security will put further pressure on other e-commerce sites to provide the same level of protection. Private email is certainly one way of protecting customers from phishing. Password protection is now the achilles heel of most systems," says Tim Pickard, area vice-president, international marketing, RSA Security.

Phishing remains a significant threat to UK online banking. Last year, Apacs said that as a result of such fraud, £4.5m had been refunded to 2,000 customers. Meanwhile, the Anti-Phishing Working Group (APWG) said that phishing attacks rose by a third last November. It found that 51 brands were attacked that month and that 1,500 phishing websites, mostly hosted in the US, were discovered. Taking down such sites took nearly a week on average, but some remained active for the month. The APWG says it is most concerned that the fraudsters are using Trojan keyloggers, which, it says, are "increasingly difficult to defend against and can snare even the most experienced internet users."